API documentation

Your own sources

A bank can bring two kinds of its own sources into its workspace, the saved search alerts of its own tender portal accounts and a company data provider it already licenses. Both stay in the bank's workspace. Neither is ever shown to another bank or added to the shared research base, and Stonewake never logs into a portal or a provider's website for you. Neither is switched on yet.

Tender portal accounts

  • An administrator adds a portal account for a team in the settings under Portal accounts, and Stonewake shows its own address once, t- followed by 32 letters and digits, @in.stonewake.ai. Enter it as the recipient of a saved search alert in the portal. No portal password is entered or stored.
  • Once switched on, the alerts of e-Vergabe des Bundes, Vergabe.NRW and vergabe.bayern (RIB Tender) are accepted. The alerts of Deutsches Vergabeportal, Vergabe24, Deutsches Ausschreibungsblatt, DTAD, HAD, vergabe.saarland, subreport and the state procurement marketplaces on cosinex are not accepted for now.
  • An alert is read only when it provably comes from the portal and names this account's own address as its recipient. The inbound server removes every authentication result a sender wrote, then records how the sender authenticated (SPF and DKIM). A mail that does not provably come from the portal, or that the portal addressed to another address, is recorded with the reason, and nothing of it is read.
  • From a verified alert, each notice the portal lists with its own notice link and a title becomes a notice of the team, with its reference, title, publication date, deadline and the portal's link. Buyer names and the other cells are not stored. The body, subject, addresses and attachments of a mail are never kept in the workspace.
  • Each notice becomes a tender match of the team, chosen by the portal's own saved search, and the team's tender profiles judge it as well. See Tender profiles and matches.
  • A mail is at most 2 MB. An address can be replaced at once, or the account ended, and mail to an old address is dropped and counted. The Test button shows how many alerts arrived and what they brought, as counts only.

Licensed company data

  • An administrator connects a company data provider the bank already licenses in the settings under Licensed data, with the bank's own key, the licence scope and the monthly quota from the bank's contract, and confirms that the contract lets a service provider use the key for the bank. The key is stored encrypted for this bank only and is never shown again.
  • Once switched on, North Data can be connected, built on its public API documentation. Creditreform and Bureau van Dijk Orbis are listed but cannot be connected yet.
  • An analyst looks a company up by its German register number with its court. The value stays in the bank's workspace, names its provider, the provider's source page and the time it was read, and is tied to a company only through the register number or LEI the provider states, never by name.
  • Each lookup counts against the monthly quota the bank declares, one company per calendar month as the provider bills it. Once the quota is used up, no further company is looked up until the next month. A lookup is sent once and never repeated on its own.
  • The Test button asks the provider with the bank's own key and shows whether the provider accepted it. A test asks about no company and counts as one request of the monthly quota, at most once a month.
  • Where the provider states a natural person or a sole trader, none of its values is stored.
  • Values read under the licence scope that also covers the bank's own systems are served over the API and MCP as well (GET /v1/licensed-data/facts, the tool licensed_facts). Values read under the other scopes stay in the dashboard.
  • The demonstration workspace answers from the provider's published sample and never calls a provider.

What is never done

  • No login to a portal or a provider's website on your behalf, and no reading of their web pages.
  • No portal notice and no licensed value in the shared research base, in another bank's workspace or in a public brief.
  • No address, key or account detail on the API or MCP.